Defensive check on changeset resolve plus tests

[jeffmaki]

Summary by CodeRabbit

• Bug Fixes

  • Tightened access checks for resolving changesets, ensuring only workspace leads or validators can complete the action.
  • Clarified and enforced permission boundaries for editing POSM elements and handling raw changeset commits.
  • Improved handling of unauthorized and unexpected failure cases for the resolve flow.

• Tests

  • Added integration coverage for resolve changeset permissions, including allowed and denied roles and error handling.

[coderabbitai]

Warning

Review limit reached

@jeffmaki, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9930aaa2-8f86-4c7e-924c-33e1175727d7

📥 Commits

Reviewing files that changed from the base of the PR and between cfa643e and a5191fe.

📒 Files selected for processing (1)

• api/src/osm/routes.py

📝 Walkthrough

Walkthrough

The resolveChangeset repository method now accepts a current_user: UserInfo parameter instead of a precomputed reviewer_uuid, performing its own workspace lead/validator authorization check and raising ForbiddenException when unauthorized. The route call site and documentation are updated accordingly, with new integration tests covering authorization outcomes.

Changes

Changeset Resolve Authorization

Layer / File(s)	Summary
Repository authorization guard api/src/osm/repository.py	resolveChangeset now accepts current_user: UserInfo, checks isWorkspaceLead/isWorkspaceValidator, raises ForbiddenException if unauthorized, and derives reviewer_uuid from current_user.
Route call site update api/src/osm/routes.py	resolve_changeset passes current_user and reordered workspace_id/changeset_id to the repository call.
Integration tests tests/integration/test_osm.py	New test module verifies 204 for validators/leads, 403 for unauthorized/cross-workspace users, and 500 on unexpected repository errors.
Enforcement documentation CLAUDE.md	Documents that Edit POSM Element is gated by isWorkspaceContributor only, resolve/validate is a native route gated by lead/validator, and clarifies downstream enforcement expectations.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: cyrossignol, MashB

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the added defensive authorization check around changeset resolve and the accompanying tests.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}